Personal information associated with approximately 850,500 unique email accounts was exposed in a cyberattack against Harvard University’s alumni and fundraising systems. The scale of the breach has become clearer after the stolen data was analyzed and added to the Have I Been Pwned breach notification service.
The intrusion dates back to November 18, 2025, when Harvard discovered unauthorized access to systems managed by its Alumni Affairs and Development department. University officials subsequently confirmed that the attackers had gained entry through a phone-based phishing attack, also known as voice phishing or vishing.
The compromised systems contained information about alumni, donors, parents of current and former students, and some faculty members, employees, and students. Exposed records included names, email addresses, telephone numbers, home and business addresses, dates of birth, donation histories, and attendance at university events.
Additional profile information identified in the leaked dataset included employment details, social media profiles, and other biographical information collected through Harvard’s alumni engagement and fundraising activities.
The cybercriminal group ShinyHunters claimed responsibility for the intrusion. In February 2026, the group published a dataset reportedly containing more than one million records after Harvard refused to pay a ransom. The university has not publicly confirmed the group’s responsibility for the attack.
The latest analysis by Have I Been Pwned identified approximately 850,500 unique email accounts within the exposed information. This figure represents distinct email addresses rather than a confirmed count of affected individuals, as the leaked database contained multiple categories of personal records.
Harvard previously stated that the compromised systems did not store Social Security numbers, account passwords, payment card information, or financial account details. However, the exposed contact information and donation records could still be useful to criminals attempting to impersonate university representatives.
Following the discovery, Harvard removed the attackers’ access and began working with law enforcement and external cybersecurity specialists. The university also notified potentially affected individuals in November 2025, advising them to watch for suspicious communications claiming to originate from Harvard.
The inclusion of the leaked dataset in Have I Been Pwned now allows individuals to check whether their email addresses appear among the compromised records. The service’s findings provide a more precise assessment of the exposure nearly a year after the original intrusion.